`npm run release` cannot push for anyone without an HTTPS credential
helper:
```
Username for 'https://github.com': …
remote: Password authentication is not supported for Git operations.
```
`scripts/release.js` pushed to a hardcoded
`https://github.com/AventurasTeam/Aventuras.git`. GitHub no longer
accepts a password there, so the push fails outright — while the
contributor's working SSH remote sits unused two lines away. (Present
since `5fd37fcb`, February; it just needed someone to cut a release from
a clone without a helper.)
### The fix
The URL was not arbitrary — releasing to `origin` would happily tag a
**fork**, and hardcoding guaranteed the canonical repository. This keeps
that guarantee and drops the transport:
`pickReleaseRemote` scans `git remote -v` for a remote whose **push URL
points at the release repository** and hands git that remote's name, so
the push uses whatever transport and credentials that remote already
has. When nothing matches it falls back to the HTTPS URL, i.e. today's
behaviour.
Two details that matter:
- **Matching is on the repository path, never the remote name**, so a
fork cannot be selected however it is called. A test pins this.
- **`unkarelian/Aventuras` is accepted alongside
`AventurasTeam/Aventuras`.** GitHub redirects the pre-rename path, so a
remote predating the move still points here — and matching on the
repository *name* alone would sweep up every fork, which is exactly what
the owner check is for.
### Notes
- Extracted into `scripts/remote.js` rather than left inline:
`release.js` cuts a release on import, so it cannot be imported by a
test. 18 cases in `scripts/remote.test.js`, following the `version.js` /
`version.test.js` split from #416.
- The console now prints `upstream (git@github.com:...)` instead of a
bare remote name, so the repository about to be released to stays
visible.
- The failure hint for an unreachable remote now names the HTTPS
fallback as a likely cause.
## Release script
- Version arithmetic extracted into `scripts/version.js`, covered by
`scripts/version.test.js`
(17 cases). `vitest.config.ts` now includes `scripts/**/*.test.js` for
it.
- **Every precondition is checked before anything is written**: a clean
tree, a version that
moves forward, and a tag/branch that exists neither locally *nor on the
remote*. A failure
after that point deletes the branch and tag it created and returns to
the original branch.
- `--dry-run` runs the checks and stops. `--no-merge-back` skips the
fast-forward of the
branch the script was run from.
- Unknown flags are rejected rather than silently ignored.
- The rollback's `reset --hard` is guarded behind a **successful
checkout**: it moves the
*current* branch, so a failed checkout dragged the release branch onto
the start commit.
- Everything after the push is explicitly best-effort and is **not**
rolled back — the tag is
out and the release is building, so a protected branch or a race there
is a reason to print
two commands, not to unpick a published release.
- Only `X.Y.Z` and `X.Y.Z-pre.N` are accepted. Other pre-release
spellings are valid semver
but match neither workflow trigger, so they would tag and build nothing.
- Works on Windows again.
Note the `--` in `npm run release -- <bump>`: without it npm consumes
the flags before the
script sees them. Documented in the README.
## eslint
`eslint-plugin-boundaries` v7 renamed `rules` to `policies` and takes
the element type inside
the `disallow` target rather than in a second outer `to`. The config was
still written for the
v6 shape — it worked, but on the deprecated path.
Verified **warning-for-warning identical** across the repo: 189
warnings, same files, same
positions, before and after.
`mode: 'folder'` dropped where it is already the default.
## Android
`src-tauri/gen/android/app/tauri.build.gradle.kts` is autogenerated by
the Tauri CLI and was
being regenerated on every build, so it showed up as a dirty file
constantly. Untracked and
gitignored.
---
Base: `upstream/master`. `check`, `lint` and the full Vitest suite pass.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved release automation with validation, dry-run support, rollback
handling, and optional branch merge-back.
* Added support for stable and prerelease version validation,
comparison, and version bumping.
* **Bug Fixes**
* Added safeguards for repository state, remote references, network
availability, and Windows npm execution.
* **Documentation**
* Expanded release instructions with supported version formats, safety
checks, rollback behavior, and usage options.
* **Tests**
* Added comprehensive coverage for version handling and release-related
scenarios.
Updates scripts/release.js to remove the --offline flag from cargo
update and automatically run npm run format and npm run lint:fix before
committing release changes.
